Main experimental setup.
We compare the results for RLAT with additional baselines: \(\operatorname{\mathbf {\ell }}_2\)  and \(\operatorname{\mathbf {\ell }}_\infty \)  adversarial training (with \(100\%\)  adversarial samples per batch), Gaussian augmentation (with both \(50\%\)  and \(100\%\)  augmentations per batch), AdvProp [1]}, Fast PAT [2]}, and also four data augmentation approaches: DeepAugment [3]}, AugMix [4]}, adversarial noise training (ANT) [5]}, and Stylized ImageNet (SIN) [6]}.
We use AugMix method additionally with the Jensen-Shannon regularization term as proposed in [4]}.
We train all methods from random initialization except ANT where we follow the scheme of [5]}. All comparisons between methods are performed with a grid search over their main hyperparameters (reported in App. ) such as \(\sigma \)  in Gaussian augmentation or \(\epsilon \)  in adversarial training which we perform on the main 15 corruptions from CIFAR-10-C / ImageNet-C. In App.  we further verify that selecting the main hyperparameters on validation corruptions leads to the same results.
For Fast PAT on CIFAR-10, we do a grid search over their parameter \(\operatorname{\mathbf {\varepsilon }}\) , but on ImageNet-100 we report the results based on the models provided by the authors due to limited computational resources.
To assess calibration, we report the expected calibration error (ECE) (see App.  for ECE with temperature rescaling [9]}).
More details can be found in our repository https://github.com/tml-epfl/adv-training-corruptions.
